Our mailserver hacked ??? - a lot of SPAM is being send out

I hope someone can help us, we really need help with our mailserver. It looks like someone has managed to get in and use our mail server to send out SPAM. We are a school with apprx. 30 email users.

We have been using the ISP's smtp-port. Now they have blocked the smtp port from our school, since a lot of spam was sent out. This means that we can not send mail outside. We have checked everything inside, also turned off everything, all computers, servers the wireless network, just left the mail and webserver on. And through the logs it looks like someone is still trying to send spam.

We want to change our smtp so we use our own, not through the ISP's port, so they don’t block us anymore. And the other thing is that we have not used authentication for our mails.

Please help us!!!!! We don’t have much experience in this, the mailserver with Suse and Postfix was set up by someone else 4 years ago.

But the problem is that I’m stuck at point 2 Modifying the php.ini. Since we have Suse I am not sure in which php.ini file I should make the changes for the smtp-port.

Code:

mail:/etc # find / -name php.ini
/etc/php5/cli/php.ini
/etc/php5/fastcgi/php.ini
/etc/php.ini
/tmp/root/ispconfig/php/php.ini
find: WARNING: Hard link count is wrong for /sys/devices: this may be a bug in your filesystem driver. Automatically turning on find's -noleaf option. Earlier results may have failed to include directories that should have been searched.
/root/ispconfig/php/php.ini

I did as suggested in the howto, and on the browser I get the message that "Mail sent.", but both mail.form and mail_php.log are empty.

I got the email inside(to a local email address) sent from "Administrator ISPConfig", but not when I changed to send to an address outside, but this is because our smtp-port is blocked from our internetprovider.
But the log's are empty.

Dear HowToForge experts,
I hope you have time to check this out and help us! Would really appreciate it!
Here you will have the results of when we lookup our IP and mailserver, then you have the configurations of our ISPConfig, and at the end the main.cf and master.cf.

As you look below, we use our ISP addresses as nameserver, even if we have declared our own nameservers in ISPConfig. Where and how can we make the changes so we don’t use our Internet providers address to send mail? Now they have blocked our smtp-port for outgoing from our school’s main IP address.
When we check smtp.example.com, that we have been using in our emailusers configurations in Outlook as Outgoing mail server, this address actually is resolved to our ISP’s address (mx1.x.net)

The mailq has not increased anymore - does this mean that the server is not trying to send more spam ?

Have tried to send mail to outgoing addresses with changing the SMTP in Outlook to mail.example.com, server IP, xmail.example.com, but it returns with "Recipient address rejected: Relay access denied".

Looking forward to your reply on how to solve this problem, or maybe we just have to reinstall the server?
Thanks for your help!